registry / first-tree-staging / 0.5.23-staging.1229.1

first-tree-staging@0.5.23-staging.1229.1

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The source shows a guarded global-install pruning hook and ordinary provider networking, not a proven malicious chain. A NUL-containing manifest-reachable bundle prevents a grounded clean verdict.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm global installation runs postinstall; invoking the CLI loads its command bundle.

Impact

Global installation can remove runtime packages; incomplete bundle analysis leaves residual supply-chain risk.

Mechanism

Global-install dependency pruning and runtime provider network support.

AI rationale

The source shows a guarded global-install pruning hook and ordinary provider networking, not a proven malicious chain. A NUL-containing manifest-reachable bundle prevents a grounded clean verdict.

Evidence

package.jsonscripts/prune-codex-runtime-binary.mjsdist/cli/index.mjsdist/connect-token-BV3106us.mjsnode_modules/@botiverse/kimi-code-sdk/dist/index.mjsnode_modules/@openai/codex-*node_modules/@anthropic-ai/claude-agent-sdk-*

Network endpoints2

api.moonshot.cn/v1api.moonshot.ai/v1

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The package runs a postinstall hook automatically.
The hook deletes bundled runtime packages during global installation.
The command entry point imports a very large bundle that contains a NUL byte, which prevented complete source analysis.
The bundled Kimi SDK includes API-key provider routing and outbound model requests.

Evidence against

The postinstall scripts return unless npm reports a global install.
The deletion targets are named bundled runtime packages rather than project or agent configuration.
The visible Kimi platform endpoints are official Moonshot API hosts.
No inspected source established secret harvesting, covert exfiltration, or automatic agent-config writes.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Source & flagged code

19 flagged

package.jsonView file

Lines 29-69json

29 "dist",

30 "context-integration",

31 "skills",

32 "scripts/prune-codex-runtime-binary.mjs",

33 "scripts/prune-claude-runtime-binary.mjs",

34 "scripts/prune-claude-sdk-deps.mjs",

35 "README.md",

36 "LICENSE"

37 ],

38 "publishConfig": {

39 "access": "public"

40 },

41 "scripts": {

42 "dev": "tsx src/cli/index.ts",

43 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @botiverse/kimi-code-sdk --external @openai/codex-sdk --external @deepseek-ai/dsh-sdk-client --external @deepseek-ai/dsh-session --external @deepseek-ai/dsh-sdk-jsonrpc-demo --external fs-native-extensions && node ../../scripts/copy-client-runtime-templates.mjs apps/cli && node ../../scripts/copy-cli-tree-templates.mjs && node ../../scripts/build-context-integration-bundle.mjs --out-dir context-integration",

44 "typecheck": "tsc --noEmit",

45 "test": "node scripts/run-vitest-batches.mjs",

46 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

47 "prepack": "node ../../scripts/copy-skill-payloads.mjs --target skills --clean && node scripts/materialize-bundled-deps.mjs prepare",

48 "postpack": "node scripts/materialize-bundled-deps.mjs restore && rm -rf skills context-integration",

49 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "license": "Apache-2.0",

52 "bundleDependencies": [

53 "@botiverse/kimi-code-sdk",

54 "@deepseek-ai/dsh-agent-spine-demo",

55 "@deepseek-ai/dsh-bash-local",

56 "@deepseek-ai/dsh-fs-local",

57 "@deepseek-ai/dsh-llm-deepseek",

58 "@deepseek-ai/dsh-sdk-client",

59 "@deepseek-ai/dsh-sdk-jsonrpc-demo",

60 "@deepseek-ai/dsh-sdk-jsonrpc-server",

61 "@deepseek-ai/dsh-sdk-protocol",

62 "@deepseek-ai/dsh-session",

63 "@deepseek-ai/dsh-session-persistence-jsonl"

64 ],

65 "repository": {

66 "type": "git",

67 "url": "https://github.com/first-tree-ai/first-tree.git",

68 "directory": "apps/cli"

69 },

dist/connect-token-BV3106us.mjsView file

18import { createHash, randomBytes, randomUUID } from "node:crypto"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L252: try { L253: const resolved = new Intl.DateTimeFormat("en-US", { timeZone: trimmed }).resolvedOptions().timeZone; L254: if (!resolved) throw new Error(`unrecognized IANA timezone: ${trimmed}`); ... L349: * L350: * @private L351: * @param {Error} err

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/connect-token-BV3106us.mjsView on unpkg · L18

18Trigger-reachable chain: manifest.exports -> dist/index.mjs -> dist/connect-token-BV3106us.mjs L18: import { createHash, randomBytes, randomUUID } from "node:crypto"; L19: import * as http from "node:http"; L20: import * as https from "node:https"; ... L22: import { AsyncLocalStorage } from "node:async_hooks"; L23: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L24: import * as util$2 from "node:util"; ... L252: try { L253: const resolved = new Intl.DateTimeFormat("en-US", { timeZone: trimmed }).resolvedOptions().timeZone; L254: if (!resolved) throw new Error(`unrecognized IANA timezone: ${trimmed}`); ... L349: * L350: * @private L351: * @param {Error} err

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/connect-token-BV3106us.mjsView on unpkg · L18

node_modules/@botiverse/kimi-code-sdk/dist/index.mjsView file

3const __filename = __cjsShimFileURLToPath(import.meta.url); L4: const __dirname = __cjsShimDirname(__filename); L5: import { createRequire } from "node:module"; ... L29: import { createControlledPromise, objectMap, sleep, uniq } from "@antfu/utils"; L30: import { execFile, execFileSync, spawn } from "node:child_process"; L31: import * as posixPath from "node:path/posix"; L32: import * as win32Path from "node:path/win32"; L33: import { createServer } from "node:http"; L34: import * as z$3 from "zod/v4"; ... L117: if (a.length !== 1) throw new Error(`Invalid character: "${a}"`); L118: const t = a.charCodeAt(0); L119: n[t] = true;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

node_modules/@botiverse/kimi-code-sdk/dist/index.mjsView on unpkg · L3

3Cross-file remote execution chain: node_modules/@botiverse/kimi-code-sdk/dist/index.mjs spawns node_modules/@botiverse/kimi-code-sdk/dist/decode-P3VnPoF0.mjs; helper contains network access plus dynamic code execution. L3: const __filename = __cjsShimFileURLToPath(import.meta.url); L4: const __dirname = __cjsShimDirname(__filename); L5: import { createRequire } from "node:module"; ... L29: import { createControlledPromise, objectMap, sleep, uniq } from "@antfu/utils"; L30: import { execFile, execFileSync, spawn } from "node:child_process"; L31: import * as posixPath from "node:path/posix"; L32: import * as win32Path from "node:path/win32"; L33: import { createServer } from "node:http"; L34: import * as z$3 from "zod/v4"; ... L117: if (a.length !== 1) throw new Error(`Invalid character: "${

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = first-tree-staging@0.5.23-staging.1228.1 matchedIdentity = npm:Zmlyc3QtdHJlZS1zdGFnaW5n:0.5.23-staging.1228.1 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.mjsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/connect-token-BV3106us.mjsView file

Findings

3 Critical13 High6 Medium4 Low

CriticalCredential Exfiltrationdist/connect-token-BV3106us.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/connect-token-BV3106us.mjs

CriticalPrevious Version Dangerous Deltadist/cli/index.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/connect-token-BV3106us.mjs

HighShelldist/connect-token-BV3106us.mjs

HighCredential Redirect Persistencedist/connect-token-BV3106us.mjs

HighCommand Output Exfiltrationdist/connect-token-BV3106us.mjs

HighCloud Metadata Accessnode_modules/@botiverse/kimi-code-sdk/dist/index.mjs

HighRemote Agent Bridgedist/connect-token-BV3106us.mjs

Affected versions and remediation

This report applies to first-tree-staging@0.5.23-staging.1229.1.

See all versions of first-tree-staging for other recorded verdicts.

Review the evidence and your use of first-tree-staging@0.5.23-staging.1229.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 01:41:35.573Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.